Privacy Policy

MorphCraft ("we", "us", "our") is committed to protecting your personal data. This policy explains what data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Our legal basis for processing personal data is your consent (for face images) and the performance of a contract (for account and billing data).

We collect the following categories of personal data:

• Account data: email address and authentication credentials
• Face images (biometric data): photographs you upload for face swap features — this is special category data under GDPR Art. 9
• Usage data: workflow executions, credit transactions, and interaction logs
• Payment data: payment is processed by Stripe — we never store card numbers or CVVs
• Communications: messages you send via the contact form

• To provide and improve the MorphCraft service
• To process payments and manage credit balances
• To detect and prevent abuse or fraud
• To respond to your support requests
• To comply with legal obligations

We do not use your face images to train AI models. We do not sell your personal data to third parties.

Face images you upload are stored securely and used solely for the AI transformations you request. You may delete your saved faces at any time from your account settings. Deletion is permanent and irreversible.

By uploading a face image you explicitly consent to its processing for the requested transformation. You certify that you have the right to use that image (it is your own face or you have the subject's consent).

• Account data: retained until you delete your account
• Generated images: retained for 30 days, then automatically deleted
• Saved faces: retained until you delete them or close your account
• Logs: retained for 90 days for security and debugging purposes

We use a single authentication session cookie necessary to keep you signed in. We do not use tracking, advertising, or analytics cookies.

• Stripe — payment processing (subject to Stripe's privacy policy)
• Supabase — database and authentication infrastructure
• Resend — transactional email delivery
• Vercel Analytics — anonymous page view and performance analytics
• Yandex Metrika — anonymous traffic analytics

Each processor is bound by data processing agreements and may only process data for the stated purpose.

If you are in the European Economic Area, you have the right to:

• Access (Art. 15): request a copy of your personal data
• Rectification (Art. 16): correct inaccurate data
• Erasure (Art. 17): request deletion of your data ("right to be forgotten")
• Portability (Art. 20): receive your data in a machine-readable format
• Withdraw consent: at any time, for face image processing
• Lodge a complaint: with your local data protection authority

If you are a California resident, you have the right to:

• Know what personal data we collect and how it is used
• Request deletion of your personal data
• Opt out of the sale of personal data

MorphCraft does not sell personal data. To exercise your rights, contact us using the information below.

We implement industry-standard security measures including encryption at rest and in transit, row-level security on all database tables, and strict access controls. No system is 100% secure; we will notify you promptly in the event of a data breach affecting your personal data.

MorphCraft is not directed at children under 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us at privacy@morphcraft.com and we will delete the account promptly.

To exercise your rights or for any privacy-related enquiries, email us at privacy@morphcraft.com or use our contact form.